They're pretty secure, though it wouldn't be impossible, I guess. They establish a VPN back to the "mother ship" and will only accept remote commands over that. If someone gained the owner's credentials they could send commands via the API endpoint used by the mobile app, but the capabilities there are pretty limited.

That said, adding the possibility of unauthorized access still doesn't make the story add up.